Rae

Privacy Policy

Last updated: 2026-09-05

This policy explains what Rae (the web app, the Telegram bot, the Rae Mini App, and this website) collects, how it's used, and the choices you have. The short version: we collect what's needed to tutor you well, we don't run ads, and we don't sell your data.

1. What we collect

• Email sign-in: the email address you provide, used to send one-time sign-in links or codes and identify your Rae account. Rae does not ask you to create a password.
• Google sign-in (optional): Google provides an account identifier and basic profile information, including your email address and name when available. Rae stores the Google account identifier and an email or name label to recognise your sign-in method. We never receive your Google password. Google sign-in requests only basic identity, email and profile permissions, not access to Gmail, Google Drive, Calendar or contacts.
• Telegram basics: your numeric Telegram ID and display name (we never see your phone number or password).
• Sign-in and security data: linked sign-in methods, temporary authentication records, session identifiers, device/browser labels, and session creation, activity and expiry times. We use essential cookies and browser storage to complete sign-in and keep you signed in.
• What you send Rae: your questions and chats, and any photos, files or voice notes you share for help.
• Learning data we derive: the topics you study, mastery estimates, flashcards, notes, quiz results and progress metrics that power Progress.
• Service data: usage metering (to enforce plan allowances), your timezone (for reminders), language/device basics, and how you arrived (e.g. which landing-page button you clicked).
• Billing status: your plan and subscription state from Stripe. Card details go directly to Stripe; we never receive or store them.

2. How we use it

To provide and personalise tutoring (remembering what you've studied and where you struggle), build your flashcards, notes and study plans, schedule reviews and reminders, enforce fair usage limits, process subscriptions, keep the service safe from abuse, and improve answer quality. We do not sell or rent your personal data, and there is no advertising.

Email and Google sign-in information is used to authenticate you, identify your Rae account, let you manage connected sign-in methods, and protect account access. Google sign-in data is not used as tutoring content or for advertising. Google sign-in is optional; you can use email instead. Connecting another sign-in method requires proof that you control it; a matching Google email address does not automatically merge existing Rae accounts.

3. Who processes it

Rae runs on a small set of service providers, each receiving only what their job needs:

• AI providers: your questions, chats and attachments are processed by OpenAI to generate answers, transcribe voice notes and power search. Anthropic is configured as an alternate answer provider and may process the same content if we switch to it.
• Image and 3D generation: when you ask Rae to generate an image or turn photos into a 3D model, those photos and prompts are processed by fal.ai.
• Google: verifies your identity when you choose Google sign-in. Google receives the authentication request; Rae receives the identity information described above. Rae does not retain Google access or refresh tokens for accessing other Google services.
• Resend: receives your email address and the sign-in message to deliver the one-time link or code you request.
• Telegram: provides messaging, Mini App access and Telegram sign-in when you choose to use it.
• Stripe: payments and subscriptions.
• Hosting: Railway (backend), Supabase (database), Cloudflare (web, security and file storage).

We use each provider on its business or API terms, not its consumer product. This list changes only when the product does, and this page is updated when it does.

4. Retention and deletion

We keep connected sign-in identifiers while those methods remain linked to your account. In Settings → Sign-in & devices, you can review connected methods, remove a method when another remains available, and sign out devices. Removing a sign-in method does not delete your Rae learning data. Sign-in links and codes expire and work once; sessions expire or can be revoked. Expiry stops a credential from working and does not itself mean its security record has been deleted.

Your chats, notes, flashcards and progress are kept while you use Rae so it can keep tutoring you with context. You can delete individual notes and topics in the App (deleting a topic deletes its questions), and hide individual quiz questions. To delete your data entirely, message @MeetRaeBot or use the feedback box in Settings and ask, and we'll confirm when it's done.

5. Children

Rae is built to keep content age-appropriate for students. If you are below the age at which you can consent to data processing in your country, use Rae only with a parent or guardian's permission.

6. Security

Traffic is encrypted in transit, access to production systems is restricted and authenticated, and payment details never touch our servers. No system is perfectly secure, but we keep the surface small and patched.

7. Changes and contact

We may update this policy as the product evolves; the date above always reflects the current version. Questions or requests? Message @MeetRaeBot or use the feedback box in the App's Settings.